@sous-io/sous 0.2.32 → 0.2.33

package/src/lib/repos/namespace-resolver.ts

@@ -1,13 +1,26 @@
 import path from "node:path";
-import { namespaceOfKey } from "../refs/parse.js";
+import { escape as escapeGlob } from "glob";
+import { braceExpand } from "minimatch";
+import {
+  RefResolveArguments,
+  RefSource,
+  namespaceOfKey,
+  splitRecipeKey,
+  sharedRefResolver,
+  splitSegments,
+  type RecipeFileRef,
+} from "../../services/ref-resolver/index.js";
+import { LockedRecipeFileLookup } from "./locked-recipe-lookup.js";
 
 /**
  * Namespace addressability for templates: the reserved `~` include sigil.
  *
- * An include line of the form `@~<namespace>/<rest>` (and the equivalent
- * `{% render "~<namespace>/<rest>" %}`) addresses a recipe namespace rather
- * than the filesystem. `<rest>` begins with the recipe name and continues with
- * the path inside that recipe, so
+ * An include line of the form `@~<namespace>/<recipe>/<path>` (and the
+ * equivalent `{% render "~<namespace>/<recipe>/<path>" %}`) addresses a recipe
+ * rather than the filesystem. The reference is read by the ref resolver service
+ * (`RefSource.Include`) and matched against the recipes the project pins, so any
+ * form that service allows works: a glob in any name or in the path, a `repo:`
+ * qualifier, a name in any case. For example
  *
  *     @~workflow/task-files/_partials/resume.md
  *
@@ -52,16 +65,17 @@ export type DroppedRecipe =
   /** The project subscribes to it, but the subscription is switched off. */
   | { by: "disabled-subscription"; subscription: string };
 
-/** A single `~namespace/rest` resolution request. */
+/** A recipe a candidate belongs to: its key and its directory. */
+export type RecipeRoot = { recipe: string; dir: string };
+
+/** A single `~` reference resolution request. */
 export type NamespaceRequest = {
-  /** The namespace name, with the leading `~` already stripped (e.g. `workflow`). */
-  namespace: string;
   /**
-   * Everything after the namespace segment: the recipe name, then the path
-   * inside that recipe (e.g. `task-files/_partials/resume.md`). Never has a
-   * leading separator.
+   * The reference with its `~` sigil taken off: namespace, recipe and the path
+   * inside the recipe (e.g. `workflow/task-files/_partials/resume.md`), as
+   * written, possibly with a `repo:` qualifier, globs and a `?name=value` query.
    */
-  rest: string;
+  reference: string;
   /**
    * Absolute path of the file performing the include, used to decide which
    * recipe (if any) is asking. A directory path is accepted for callers that
@@ -79,14 +93,23 @@ export type NamespaceRequest = {
  * grow without breaking older callers.
  */
 export type NamespaceResolution =
-  /** Ordered absolute paths to try, most preferred first. An empty list means the lookup produced nothing. */
-  | { kind: "candidates"; candidates: string[] }
+  /**
+   * Ordered absolute paths to try, most preferred first. An empty list means
+   * the lookup produced nothing. When `glob` is true the reference was a glob:
+   * every candidate is a pattern (the recipe's own directory escaped), and ALL
+   * of them are included, in order, not just the first that exists.
+   * `roots`, when present, holds the recipe (and its directory) each candidate belongs to
+   * (same length and order); a caller that reads files refuses any file whose
+   * real path is outside its root, which is how a symlink inside a recipe cannot
+   * lead out of it.
+   */
+  | { kind: "candidates"; candidates: string[]; glob?: true; roots?: RecipeRoot[] }
   /**
    * No such namespace is known at all. `known` lists the namespaces that are.
    * `dropped` says why a project template's recipe is no longer pinned, when
    * that can be known.
    */
-  | { kind: "unknown-namespace"; known: string[]; dropped?: DroppedRecipe }
+  | { kind: "unknown-namespace"; namespace: string; recipe: string; known: string[]; dropped?: DroppedRecipe }
   /**
    * The namespace exists but holds no such recipe. `recipe` is the fully
    * qualified ref that was asked for; `known` lists the recipe refs the
@@ -107,17 +130,32 @@ export type NamespaceResolution =
    * recipe's own files and nothing else, so this is refused rather than
    * resolved. `reference` is the reference as it was written.
    */
-  | { kind: "escapes-recipe"; recipe: string; reference: string };
+  | { kind: "escapes-recipe"; recipe: string; reference: string }
+  /**
+   * The reference is not one an include line may hold (it names no file inside
+   * a recipe, carries a version range, and so on). `message` is the ref
+   * service's own sentence, which says what to write instead.
+   */
+  | { kind: "invalid"; reference: string; message: string };
 
-/** Resolves `~namespace/rest` references to candidate absolute paths. */
+/** Resolves `~` references to candidate absolute paths. */
 export interface NamespaceResolver {
   /**
-   * Resolve one `~namespace/rest` reference.
+   * Resolve one `~` reference.
    *
-   * @param request - The namespace, the remainder of the reference, and the including file.
+   * @param request - The reference and the including file.
    * @returns Candidate absolute paths (most preferred first), or a reason the lookup failed.
    */
   resolve(request: NamespaceRequest): NamespaceResolution;
+
+  /**
+   * The ref of the recipe whose directory holds `fromFile`, or null when the
+   * file is not inside any recipe (a project template). Optional: a resolver
+   * that cannot tell is treated as one for which every file is the project's.
+   *
+   * @param fromFile - Absolute path of a file or directory.
+   */
+  includingRecipe?(fromFile: string): string | null;
 }
 
 /**
@@ -125,43 +163,49 @@ export interface NamespaceResolver {
  * message. Each line is indented by two spaces so it can be appended directly
  * to the compiler's "Include not found" block.
  *
- * @param opts.namespace - The namespace that was asked for.
- * @param opts.rest - The remainder of the reference (recipe name plus inner path).
  * @param opts.fromFile - The file (or directory) that performed the include.
  * @param opts.resolution - What the resolver returned.
  * @returns Indented, newline-joined explanation lines; an empty string when there is nothing to add.
  */
 export function formatNamespaceProblem(opts: {
-  namespace: string;
-  rest: string;
   fromFile: string;
   resolution: NamespaceResolution;
 }): string {
-  const lines: string[] = [`in file: ${opts.fromFile}`, `namespace: ${opts.namespace}`];
-
   const resolution = opts.resolution;
 
   if (resolution.kind === "candidates") {
     return "";
   }
 
+  if (resolution.kind === "invalid") {
+    return [`in file: ${opts.fromFile}`, `reference: ~${resolution.reference}`, ...resolution.message.split("\n")]
+      .map((line) => `  ${line}`)
+      .join("\n");
+  }
+
+  const namespace =
+    resolution.kind === "unknown-namespace"
+      ? resolution.namespace
+      : namespaceOfKey(resolution.recipe);
+  const lines: string[] = [`in file: ${opts.fromFile}`, `namespace: ${namespace}`];
+
   if (resolution.kind === "unknown-namespace") {
-    lines.push(`There is no recipe namespace named "${opts.namespace}" available here.`);
+    lines.push(`There is no recipe namespace named "${namespace}" available here.`);
     lines.push(
       resolution.known.length > 0
         ? `Available namespaces: ${resolution.known.join(", ")}.`
         : "This project has no recipe namespaces available yet."
     );
-    if (resolution.dropped) lines.push(...describeDropped(resolution.dropped, opts));
+    if (resolution.dropped) lines.push(...describeDropped(resolution.dropped, resolution.recipe));
   } else if (resolution.kind === "unknown-recipe") {
     lines.push(`recipe: ${resolution.recipe}`);
-    lines.push(`The namespace "${opts.namespace}" holds no recipe named "${resolution.recipe}".`);
+    lines.push(`The namespace "${namespace}" holds no recipe named "${resolution.recipe}".`);
     lines.push(
       resolution.known.length > 0
         ? `Recipes in this namespace: ${resolution.known.join(", ")}.`
-        : `The namespace "${opts.namespace}" currently holds no recipes.`
+        : `The namespace "${namespace}" currently holds no recipes.`
     );
-    if (resolution.dropped) lines.push(...describeDropped(resolution.dropped, opts));
+    if (resolution.dropped) lines.push(...describeDropped(resolution.dropped, resolution.recipe));
   } else if (resolution.kind === "not-a-dependency") {
     lines.push(`recipe: ${resolution.recipe}`);
     if (resolution.includingRecipe) {
@@ -169,7 +213,7 @@ export function formatNamespaceProblem(opts: {
         `The recipe "${resolution.includingRecipe}" does not declare "${resolution.recipe}" as a dependency.`
       );
       lines.push(
-        `Add "${resolution.recipe}" to the "depends" list in that recipe's manifest before addressing it as "~${opts.namespace}".`
+        `Add "${resolution.recipe}" to the "depends" list in that recipe's manifest before addressing it as "~${namespace}".`
       );
     } else {
       lines.push(`The project's own templates may not address "${resolution.recipe}".`);
@@ -181,7 +225,8 @@ export function formatNamespaceProblem(opts: {
     );
     lines.push(
       `A "~namespace" reference addresses a recipe's own files, so it may not contain ` +
-        `"." or ".." segments and may not be an absolute path.`
+        `"." or ".." segments (also inside a { } alternative), may not be an absolute path, ` +
+        `and may not reach a file through a link that leaves the recipe.`
     );
     lines.push(
       `Write the path of a file inside the recipe, or include the other file by a ` +
@@ -197,13 +242,9 @@ export function formatNamespaceProblem(opts: {
  * pinned, and what brings it back.
  *
  * @param dropped - What is known about how the recipe used to be pinned.
- * @param opts - The namespace and the rest of the reference, for the recipe's name.
+ * @param recipe - The `namespace/recipe` the template asked for.
  */
-function describeDropped(
-  dropped: DroppedRecipe,
-  opts: { namespace: string; rest: string }
-): string[] {
-  const { recipe } = splitIncludePath(opts.namespace, opts.rest);
+function describeDropped(dropped: DroppedRecipe, recipe: string): string[] {
   if (dropped.by === "disabled-subscription") {
     return [
       `This project subscribes to "${dropped.subscription}", but that subscription is ` +
@@ -253,6 +294,12 @@ export type StaticNamespaceResolverOptions = {
    * to a recipe the resolver does not know.
    */
   explainMissing?: (recipe: string) => DroppedRecipe | undefined;
+  /**
+   * The short name of the repository each recipe came from, keyed like
+   * `recipes`. It is what a `repo:` qualifier in an include line is matched
+   * against; a recipe with no entry matches no qualifier.
+   */
+  repos?: Record<string, string>;
 };
 
 /**
@@ -269,6 +316,7 @@ export class StaticNamespaceResolver implements NamespaceResolver {
   private readonly dependencies: Record<string, string[]>;
   private readonly projectScope?: string[];
   private readonly explainMissing?: (recipe: string) => DroppedRecipe | undefined;
+  private readonly lookup: LockedRecipeFileLookup;
 
   constructor(options: StaticNamespaceResolverOptions) {
     this.recipes = {};
@@ -278,6 +326,17 @@ export class StaticNamespaceResolver implements NamespaceResolver {
     this.dependencies = options.dependencies ?? {};
     this.projectScope = options.projectScope;
     this.explainMissing = options.explainMissing;
+    this.lookup = new LockedRecipeFileLookup(
+      Object.keys(this.recipes).map((key) => {
+        const recipe = splitRecipeKey(key);
+        const repo = options.repos?.[key];
+        return {
+          namespace: recipe.namespace,
+          name: recipe.name ?? "",
+          ...(repo === undefined ? {} : { repo }),
+        };
+      })
+    );
   }
 
   /**
@@ -291,28 +350,12 @@ export class StaticNamespaceResolver implements NamespaceResolver {
     return dropped === undefined ? {} : { dropped };
   }
 
-  /** Every namespace this resolver knows about, sorted. */
-  private knownNamespaces(): string[] {
-    const names = new Set<string>();
-    for (const ref of Object.keys(this.recipes)) {
-      names.add(namespaceOfKey(ref));
-    }
-    return [...names].sort();
-  }
-
-  /** Every known recipe ref inside one namespace, sorted. */
-  private recipesIn(namespace: string): string[] {
-    return Object.keys(this.recipes)
-      .filter((ref) => namespaceOfKey(ref) === namespace)
-      .sort();
-  }
-
   /**
    * The ref of the recipe whose directory contains `fromFile`, or null when the
    * file lives outside every recipe (a project template). The deepest matching
    * recipe directory wins, so nested layouts resolve to the innermost recipe.
    */
-  private includingRecipe(fromFile: string): string | null {
+  includingRecipe(fromFile: string): string | null {
     const target = path.resolve(fromFile);
     let best: string | null = null;
     let bestLength = -1;
@@ -328,27 +371,72 @@ export class StaticNamespaceResolver implements NamespaceResolver {
     return best;
   }
 
-  resolve(request: NamespaceRequest): NamespaceResolution {
-    const { namespace, rest, fromFile } = request;
-
-    const { recipe: ref, segments } = splitIncludePath(namespace, rest);
-
-    if (!this.knownNamespaces().includes(namespace)) {
-      return {
-        kind: "unknown-namespace",
-        known: this.knownNamespaces(),
-        ...this.droppedFor(ref, fromFile),
-      };
+  /**
+   * The answer for a reference the ref service refused: a path that climbs out
+   * of the recipe is `escapes-recipe`, and anything else is `invalid`, with the
+   * service's own sentence.
+   */
+  private refused(reference: string, error: unknown): NamespaceResolution {
+    const resolver = sharedRefResolver();
+    try {
+      const { dropped } = resolver.inspect(reference, RefSource.Include);
+      for (const entry of dropped) {
+        if (entry.ref.kind !== "recipeFile") continue;
+        if (splitSegments(entry.ref.path).some((part) => part === "." || part === "..")) {
+          return {
+            kind: "escapes-recipe",
+            recipe: `${entry.ref.recipe.namespace?.name ?? ""}/${entry.ref.recipe.name}`,
+            reference,
+          };
+        }
+      }
+    } catch {
+      // Not a ref in any reading; the original refusal says why.
     }
+    const message = error instanceof Error ? error.message : String(error);
+    return { kind: "invalid", reference, message };
+  }
 
-    const recipeDir = this.recipes[ref];
+  resolve(request: NamespaceRequest): NamespaceResolution {
+    const { reference, fromFile } = request;
+    const resolver = sharedRefResolver();
+
+    let result;
+    try {
+      result = resolver.resolveSync(new RefResolveArguments({
+        input: reference,
+        from: RefSource.Include,
+        lookup: this.lookup,
+        kinds: ["recipeFile"],
+      }));
+    } catch (error) {
+      return this.refused(reference, error);
+    }
 
-    if (!recipeDir) {
+    // The reading the caller meant: of a `?name=value` that could also be part
+    // of a glob, the one that read it as values comes first.
+    const { kept } = resolver.inspect(reference, RefSource.Include);
+    const written = (kept.find((ref) => ref.vars !== undefined) ?? kept[0]) as RecipeFileRef;
+    const namespaceName = written.recipe.namespace?.name ?? "";
+    const wanted = `${namespaceName}/${written.recipe.name}`;
+
+    const matched = result.refs.filter((ref): ref is RecipeFileRef => ref.kind === "recipeFile");
+    if (matched.length === 0) {
+      if (written.glob === true) return { kind: "candidates", candidates: [], glob: true };
+      if (!this.lookup.knowsNamespace(namespaceName)) {
+        return {
+          kind: "unknown-namespace",
+          namespace: namespaceName,
+          recipe: wanted,
+          known: this.lookup.namespaces(),
+          ...this.droppedFor(wanted, fromFile),
+        };
+      }
       return {
         kind: "unknown-recipe",
-        recipe: ref,
-        known: this.recipesIn(namespace),
-        ...this.droppedFor(ref, fromFile),
+        recipe: wanted,
+        known: this.lookup.recipesInNamespace(namespaceName),
+        ...this.droppedFor(wanted, fromFile),
       };
     }
 
@@ -357,66 +445,57 @@ export class StaticNamespaceResolver implements NamespaceResolver {
       ? [includingRecipe, ...(this.dependencies[includingRecipe] ?? [])]
       : this.projectScope;
 
-    if (declared !== undefined && !declaresRef(declared, namespace, ref)) {
-      return { kind: "not-a-dependency", recipe: ref, includingRecipe };
-    }
+    const candidates: string[] = [];
+    const roots: RecipeRoot[] = [];
+    for (const ref of matched) {
+      const key = `${ref.recipe.namespace?.name ?? ""}/${ref.recipe.name}`;
+      const recipeDir = this.recipes[key];
+      if (recipeDir === undefined) continue;
 
-    const inner = segments.join("/");
-    const resolved = path.resolve(recipeDir, inner);
-
-    // A `~namespace` reference addresses a recipe's own files. Without this the
-    // reference could walk out of the recipe with `..` segments and have the
-    // compiler render anything on the machine into the project's output. The
-    // segment check catches the written form, and the relative check catches
-    // everything else, including an absolute inner path and any symlink-free
-    // route out that normalisation would otherwise hide.
-    if (escapesRecipe(recipeDir, segments, inner, resolved)) {
-      return { kind: "escapes-recipe", recipe: ref, reference: `${namespace}/${rest}` };
+      if (declared !== undefined && !declaresRef(declared, ref.recipe.namespace?.name ?? "", key)) {
+        if (written.glob === true) continue;
+        return { kind: "not-a-dependency", recipe: key, includingRecipe };
+      }
+
+      if (written.glob === true) {
+        // A brace alternative can hold a `.` or `..` segment that the ref
+        // service keeps inside one segment (`{..,x}`), so expand every
+        // alternative and refuse any that climbs.
+        const climbs = braceExpand(ref.path).some((alternative) =>
+          alternative.split("/").some((part) => part === "." || part === "..")
+        );
+        if (climbs) return { kind: "escapes-recipe", recipe: key, reference };
+        candidates.push(`${escapeGlob(recipeDir)}/${ref.path}`);
+        roots.push({ recipe: key, dir: recipeDir });
+        continue;
+      }
+
+      const resolved = path.resolve(recipeDir, ref.path);
+      // A `~` reference addresses a recipe's own files. The ref service already
+      // refuses `.` and `..` segments; this catches whatever else would leave
+      // the recipe directory, so a reference can never have the compiler render
+      // anything on the machine into the project's output.
+      if (escapesRecipe(recipeDir, resolved)) {
+        return { kind: "escapes-recipe", recipe: key, reference };
+      }
+      candidates.push(resolved);
+      roots.push({ recipe: key, dir: recipeDir });
     }
 
-    return { kind: "candidates", candidates: [resolved] };
+    return written.glob === true
+      ? { kind: "candidates", candidates, glob: true, roots }
+      : { kind: "candidates", candidates, roots };
   }
 }
 
 /**
- * Takes the part of a `@~namespace/...` include line after the namespace apart:
- * its first segment names the recipe, and the rest is a file path inside it.
- * This is an include path, not a ref; it is the one place such a path is split.
- *
- * splitIncludePath("workflow", "task-files/_partials/resume.md")
- * // -> { recipe: "workflow/task-files", segments: ["_partials", "resume.md"] }
- *
- * @param namespace - The namespace the include line named.
- * @param rest - Everything after `~<namespace>/`.
- */
-function splitIncludePath(
-  namespace: string,
-  rest: string
-): { recipe: string; segments: string[] } {
-  const [recipeName = "", ...segments] = rest
-    .split("/")
-    .filter((segment) => segment.length > 0);
-  return { recipe: `${namespace}/${recipeName}`, segments };
-}
-
-/**
- * Whether an inner path would address something outside the recipe directory.
+ * Whether a resolved path sits outside the recipe directory.
  *
  * @param recipeDir - The recipe's absolute directory.
- * @param innerSegments - The inner path's segments, as they were written.
- * @param inner - Those segments rejoined.
  * @param resolved - What the inner path resolved to.
  */
-function escapesRecipe(
-  recipeDir: string,
-  innerSegments: string[],
-  inner: string,
-  resolved: string
-): boolean {
-  if (innerSegments.some((segment) => segment === "." || segment === "..")) return true;
-  if (inner !== "" && path.isAbsolute(inner)) return true;
+function escapesRecipe(recipeDir: string, resolved: string): boolean {
   if (resolved === recipeDir) return false;
-
   const relative = path.relative(recipeDir, resolved);
   return relative === "" || relative.startsWith("..") || path.isAbsolute(relative);
 }

package/src/lib/repos/recipe-config-layers.ts

@@ -55,12 +55,19 @@ export const RECIPE_CONFIG_ALLOWED_KEYS = [
   "_aliases",
   "_vars",
   "compilation",
-  "recipeOutputs",
+  "recipes",
   "runtimeContext",
   "store",
   "varMappings",
 ] as const;
 
+/**
+ * The keys under `recipes` a recipe's config layer may set. `recipes.memories`
+ * decides which memories the project includes and in what order, which is the
+ * project's own choice, so a recipe may not set it.
+ */
+export const RECIPE_CONFIG_ALLOWED_RECIPES_KEYS = ["skills"] as const;
+
 /**
  * Plain-language reasons for the refused keys a recipe is most likely to try,
  * so the warning says why rather than only that.
@@ -130,6 +137,27 @@ export function filterRecipeConfigLayer(
   const config: Record<string, unknown> = {};
 
   for (const key of Object.keys(raw)) {
+    if (key === "recipes") {
+      const value = (raw as Record<string, unknown>)[key];
+      const kept: Record<string, unknown> = {};
+      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        for (const sub of Object.keys(value)) {
+          if ((RECIPE_CONFIG_ALLOWED_RECIPES_KEYS as readonly string[]).includes(sub)) {
+            kept[sub] = (value as Record<string, unknown>)[sub];
+            continue;
+          }
+          warnings.push(
+            `The recipe ${recipeKey} tried to set 'recipes.${sub}' in a config layer, and sous ` +
+              `removed it before merging anything:\n  ${layerPath}\n` +
+              `That key is not one a recipe may set (it configures the project, not the recipe). ` +
+              `Under 'recipes' a recipe's config layer may set only: ` +
+              `${RECIPE_CONFIG_ALLOWED_RECIPES_KEYS.join(", ")}.`
+          );
+        }
+      }
+      config[key] = kept;
+      continue;
+    }
     if (allowed.has(key)) {
       config[key] = (raw as Record<string, unknown>)[key];
       continue;

package/src/lib/repos/recipe-key-matcher.ts

@@ -0,0 +1,62 @@
+/**
+ * Matching recipe keys (`namespace/recipe`) against the lists a config holds, such
+ * as `recipes.memories.first` and `recipes.memories.exclude`.
+ *
+ * Each entry of such a list is a glob (`communication/*`), or, when it is
+ * written between two slashes (`/^tool-usage\//`), a regular expression. A
+ * regular expression is written as a string because the config kernel passes
+ * every layer through JSON, which has no way to carry a `RegExp`.
+ */
+
+import { minimatch } from "minimatch";
+import { ConfigError } from "../errors.js";
+
+/** True when the string is written `/.../`, the spelling of a regular expression. */
+export function isRegexSpelling(entry: string): boolean {
+  return entry.length >= 3 && entry.startsWith("/") && entry.endsWith("/");
+}
+
+/**
+ * Compiles one entry of a recipe key list into a matcher.
+ *
+ * @param entry - A glob, or a regular expression written `/.../`.
+ * @param where - The config key the entry came from, named in the error, such as
+ *   `recipes.memories.exclude`.
+ * @throws ConfigError when the entry is a regular expression that does not compile.
+ */
+function compileEntry(entry: string, where: string): (key: string) => boolean {
+  if (isRegexSpelling(entry)) {
+    let expression: RegExp;
+    try {
+      expression = new RegExp(entry.slice(1, -1));
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new ConfigError(
+        `The value ${JSON.stringify(entry)} in '${where}' is written as a regular ` +
+          `expression, but it is not a valid one: ${reason}`
+      );
+    }
+    return (key) => expression.test(key);
+  }
+  return (key) => minimatch(key, entry);
+}
+
+/**
+ * Compiles a list of globs and `/.../` regular expressions into one matcher over
+ * recipe keys. The matcher is true when ANY entry matches; an empty or missing
+ * list matches nothing.
+ *
+ * compileRecipeKeyMatcher(["communication/*", "/^tool-usage\\//"], "recipes.memories.first")("communication/tone");
+ * // -> true
+ *
+ * @param entries - The configured list.
+ * @param where - The config key the list came from, named in any error.
+ * @throws ConfigError when an entry is an invalid regular expression.
+ */
+export function compileRecipeKeyMatcher(
+  entries: readonly string[] | undefined,
+  where: string
+): (recipeKey: string) => boolean {
+  const matchers = (entries ?? []).map((entry) => compileEntry(entry, where));
+  return (recipeKey) => matchers.some((matches) => matches(recipeKey));
+}